From ed9e12a42122c62a8348a8649f8e55957ba7e20e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 26 Aug 2025 17:36:26 +0000 Subject: [PATCH 1/2] Initial plan From 2a554480d61be3c43a7600614db6d312791a84d9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 26 Aug 2025 17:46:09 +0000 Subject: [PATCH 2/2] Complete vulnerable dependencies sample implementation Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- Directory.Packages.props | 21 ++++ README.md | 113 +++++++++++++++++- VulnerableDependencies.sln | 41 +++++++ src/VulnerableConsole/Program.cs | 46 +++++++ .../VulnerableConsole.csproj | 18 +++ src/VulnerableLibrary/Class1.cs | 42 +++++++ src/VulnerableLibrary/NLog.config | 16 +++ .../VulnerableLibrary.csproj | 15 +++ src/VulnerableWebApi/Program.cs | 63 ++++++++++ .../Properties/launchSettings.json | 41 +++++++ src/VulnerableWebApi/VulnerableWebApi.csproj | 21 ++++ src/VulnerableWebApi/VulnerableWebApi.http | 6 + .../appsettings.Development.json | 8 ++ src/VulnerableWebApi/appsettings.json | 9 ++ 14 files changed, 458 insertions(+), 2 deletions(-) create mode 100644 Directory.Packages.props create mode 100644 VulnerableDependencies.sln create mode 100644 src/VulnerableConsole/Program.cs create mode 100644 src/VulnerableConsole/VulnerableConsole.csproj create mode 100644 src/VulnerableLibrary/Class1.cs create mode 100644 src/VulnerableLibrary/NLog.config create mode 100644 src/VulnerableLibrary/VulnerableLibrary.csproj create mode 100644 src/VulnerableWebApi/Program.cs create mode 100644 src/VulnerableWebApi/Properties/launchSettings.json create mode 100644 src/VulnerableWebApi/VulnerableWebApi.csproj create mode 100644 src/VulnerableWebApi/VulnerableWebApi.http create mode 100644 src/VulnerableWebApi/appsettings.Development.json create mode 100644 src/VulnerableWebApi/appsettings.json diff --git a/Directory.Packages.props b/Directory.Packages.props new file mode 100644 index 0000000..da383e0 --- /dev/null +++ b/Directory.Packages.props @@ -0,0 +1,21 @@ + + + true + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/README.md b/README.md index 4066795..33b3847 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,111 @@ -# vulnerable-dependencies -Simulates a repository with multiple projects, CPM, and vulnerable direct and transitive dependencies +# Vulnerable Dependencies Sample + +This repository demonstrates a .NET 8 solution with multiple projects that include various vulnerable direct and transitive dependencies, managed through Central Package Management (CPM). + +## Purpose + +This sample showcases: +- **Direct vulnerable dependencies**: Packages directly referenced in projects that have known security vulnerabilities +- **Transitive vulnerable dependencies**: Vulnerable packages that are pulled in as dependencies of other packages +- **Central Package Management**: Centralized package version management using `Directory.Packages.props` +- **Security scanning**: How .NET detects and reports vulnerable packages during build/restore + +## Solution Structure + +``` +├── VulnerableDependencies.sln +├── Directory.Packages.props # Central Package Management configuration +└── src/ + ├── VulnerableWebApi/ # ASP.NET Core Web API with vulnerable packages + ├── VulnerableLibrary/ # Class library with vulnerable dependencies + └── VulnerableConsole/ # Console application with vulnerable packages +``` + +## Vulnerable Dependencies Included + +### Direct Vulnerable Dependencies + +| Package | Version | Severity | CVE/Advisory | Project | +|---------|---------|----------|--------------|---------| +| `Newtonsoft.Json` | 10.0.1 | High | [GHSA-5crp-9r3c-p9vr](https://github.com/advisories/GHSA-5crp-9r3c-p9vr) | VulnerableWebApi | +| `NLog` | 4.4.0 | Various | Multiple vulnerabilities | VulnerableLibrary | +| `System.IdentityModel.Tokens.Jwt` | 5.1.0 | Moderate | [GHSA-59j7-ghrg-fj52](https://github.com/advisories/GHSA-59j7-ghrg-fj52) | VulnerableLibrary | +| `Microsoft.Data.SqlClient` | 1.0.19239.1 | High/Moderate | Multiple ([GHSA-8g2p-5pqh-5jmc](https://github.com/advisories/GHSA-8g2p-5pqh-5jmc), [GHSA-98g6-xh36-x2p7](https://github.com/advisories/GHSA-98g6-xh36-x2p7)) | VulnerableConsole | + +### Packages with Vulnerable Transitive Dependencies + +| Package | Version | Brings Vulnerable Dependencies | Project | +|---------|---------|-------------------------------|---------| +| `Microsoft.AspNetCore.Authentication.JwtBearer` | 3.1.0 | Moderate vulnerability [GHSA-q7cg-43mg-qp69](https://github.com/advisories/GHSA-q7cg-43mg-qp69) | VulnerableWebApi | +| `Microsoft.Extensions.Logging.Console` | 3.1.0 | Various transitive vulnerabilities | VulnerableConsole | + +## Central Package Management + +This solution uses Central Package Management (CPM) configured in `Directory.Packages.props`: + +- **Centralized version control**: All package versions are defined in one place +- **Consistent versioning**: Ensures all projects use the same package versions +- **Simplified maintenance**: Easy to update package versions across all projects + +## Building and Running + +### Prerequisites +- .NET 8 SDK or later + +### Build the Solution +```bash +dotnet restore +dotnet build +``` + +### Run Individual Projects + +**Console Application:** +```bash +dotnet run --project src/VulnerableConsole +``` + +**Web API:** +```bash +dotnet run --project src/VulnerableWebApi +``` +Then navigate to `https://localhost:5001/swagger` to see the API documentation. + +## Security Warnings + +When you build or restore this solution, you'll see security warnings like: + +``` +warning NU1902: Package 'Microsoft.Data.SqlClient' 1.0.19239.1 has a known moderate severity vulnerability +warning NU1903: Package 'Newtonsoft.Json' 10.0.1 has a known high severity vulnerability +``` + +These warnings are **intentional** and demonstrate how .NET's built-in security scanning works. + +## Educational Use Cases + +This sample is useful for: + +1. **Security Training**: Understanding how vulnerable dependencies affect applications +2. **Tool Testing**: Testing dependency scanning tools and security scanners +3. **DevOps Pipeline Testing**: Verifying that CI/CD pipelines properly detect and handle vulnerable dependencies +4. **Remediation Practice**: Learning how to identify and fix vulnerable dependencies + +## Fixing Vulnerabilities + +To fix the vulnerabilities in this sample: + +1. Update package versions in `Directory.Packages.props` to latest stable versions +2. Remove or replace packages that don't have secure versions available +3. Use `dotnet list package --vulnerable` to identify vulnerable packages +4. Use `dotnet list package --outdated` to find packages that can be updated + +## ⚠️ Warning + +**This repository contains intentionally vulnerable dependencies and should not be used in production environments.** It is designed for educational and testing purposes only. + +## Sample Code Features + +- **VulnerableWebApi**: JWT authentication and JSON serialization using vulnerable packages +- **VulnerableLibrary**: Logging and JWT token processing with security issues +- **VulnerableConsole**: Database connectivity and logging with known vulnerabilities diff --git a/VulnerableDependencies.sln b/VulnerableDependencies.sln new file mode 100644 index 0000000..5afe08c --- /dev/null +++ b/VulnerableDependencies.sln @@ -0,0 +1,41 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.0.31903.59 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{34C94C4A-DE9C-4CD9-AD80-F66C69412824}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VulnerableWebApi", "src\VulnerableWebApi\VulnerableWebApi.csproj", "{E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VulnerableLibrary", "src\VulnerableLibrary\VulnerableLibrary.csproj", "{95447720-38D1-4454-A425-B0BF2C45E43C}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VulnerableConsole", "src\VulnerableConsole\VulnerableConsole.csproj", "{9E019C7B-FC5C-4666-8A1D-81908068EE22}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49}.Debug|Any CPU.Build.0 = Debug|Any CPU + {E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49}.Release|Any CPU.ActiveCfg = Release|Any CPU + {E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49}.Release|Any CPU.Build.0 = Release|Any CPU + {95447720-38D1-4454-A425-B0BF2C45E43C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {95447720-38D1-4454-A425-B0BF2C45E43C}.Debug|Any CPU.Build.0 = Debug|Any CPU + {95447720-38D1-4454-A425-B0BF2C45E43C}.Release|Any CPU.ActiveCfg = Release|Any CPU + {95447720-38D1-4454-A425-B0BF2C45E43C}.Release|Any CPU.Build.0 = Release|Any CPU + {9E019C7B-FC5C-4666-8A1D-81908068EE22}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {9E019C7B-FC5C-4666-8A1D-81908068EE22}.Debug|Any CPU.Build.0 = Debug|Any CPU + {9E019C7B-FC5C-4666-8A1D-81908068EE22}.Release|Any CPU.ActiveCfg = Release|Any CPU + {9E019C7B-FC5C-4666-8A1D-81908068EE22}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(NestedProjects) = preSolution + {E55C3A72-CCBE-4C4C-8012-7D2A63A9BB49} = {34C94C4A-DE9C-4CD9-AD80-F66C69412824} + {95447720-38D1-4454-A425-B0BF2C45E43C} = {34C94C4A-DE9C-4CD9-AD80-F66C69412824} + {9E019C7B-FC5C-4666-8A1D-81908068EE22} = {34C94C4A-DE9C-4CD9-AD80-F66C69412824} + EndGlobalSection +EndGlobal diff --git a/src/VulnerableConsole/Program.cs b/src/VulnerableConsole/Program.cs new file mode 100644 index 0000000..501e458 --- /dev/null +++ b/src/VulnerableConsole/Program.cs @@ -0,0 +1,46 @@ +using Microsoft.Data.SqlClient; +using Microsoft.Extensions.Logging; + +// Create logger using vulnerable Microsoft.Extensions.Logging.Console 3.1.0 +using var loggerFactory = LoggerFactory.Create(builder => + builder.AddConsole()); +var logger = loggerFactory.CreateLogger(); + +logger.LogInformation("Starting Vulnerable Dependencies Console Sample"); + +// Example 1: Demonstrate vulnerable Microsoft.Data.SqlClient usage +await DemonstrateVulnerableSqlClient(logger); + +// Example 2: Demonstrate vulnerable transitive dependencies through logging +DemonstrateVulnerableLogging(logger); + +logger.LogInformation("Sample completed"); + +static async Task DemonstrateVulnerableSqlClient(ILogger logger) +{ + try + { + // This uses Microsoft.Data.SqlClient 1.0.19239.1 which has known vulnerabilities + var connectionString = "Server=localhost;Database=TestDb;Integrated Security=true;TrustServerCertificate=true;"; + + // Note: This will fail to connect since there's no SQL Server, but demonstrates the usage + using var connection = new SqlConnection(connectionString); + logger.LogInformation("Attempting to connect using vulnerable SqlClient..."); + + // In a real scenario, this would attempt to connect + logger.LogWarning("SqlClient connection attempt (will fail - no server available)"); + } + catch (Exception ex) + { + logger.LogError(ex, "Expected error - demonstrating vulnerable SqlClient usage"); + } +} + +static void DemonstrateVulnerableLogging(ILogger logger) +{ + // This logging infrastructure uses vulnerable transitive dependencies + logger.LogDebug("Debug message using vulnerable logging infrastructure"); + logger.LogInformation("Information message demonstrating vulnerable transitive dependencies"); + logger.LogWarning("Warning about using outdated logging packages"); + logger.LogError("Error message showing security risks in dependency chain"); +} diff --git a/src/VulnerableConsole/VulnerableConsole.csproj b/src/VulnerableConsole/VulnerableConsole.csproj new file mode 100644 index 0000000..14959c0 --- /dev/null +++ b/src/VulnerableConsole/VulnerableConsole.csproj @@ -0,0 +1,18 @@ + + + + Exe + net8.0 + enable + enable + + + + + + + + + + + diff --git a/src/VulnerableLibrary/Class1.cs b/src/VulnerableLibrary/Class1.cs new file mode 100644 index 0000000..b3b71b1 --- /dev/null +++ b/src/VulnerableLibrary/Class1.cs @@ -0,0 +1,42 @@ +using NLog; +using System.IdentityModel.Tokens.Jwt; + +namespace VulnerableLibrary; + +/// +/// Sample library demonstrating usage of vulnerable dependencies +/// +public class VulnerableLibraryService +{ + private static readonly Logger Logger = LogManager.GetCurrentClassLogger(); + + /// + /// Demonstrates usage of vulnerable NLog 4.4.0 + /// + public void LogMessage(string message) + { + // This uses vulnerable NLog 4.4.0 which has known security issues + Logger.Info($"Processing message: {message}"); + } + + /// + /// Demonstrates usage of vulnerable System.IdentityModel.Tokens.Jwt 5.1.0 + /// + public string ProcessJwtToken(string token) + { + try + { + // This uses vulnerable JWT library 5.1.0 with known security vulnerabilities + var handler = new JwtSecurityTokenHandler(); + var jsonToken = handler.ReadJwtToken(token); + + Logger.Info($"JWT processed successfully. Subject: {jsonToken.Subject}"); + return jsonToken.Subject ?? "Unknown"; + } + catch (Exception ex) + { + Logger.Error(ex, "Failed to process JWT token"); + throw; + } + } +} diff --git a/src/VulnerableLibrary/NLog.config b/src/VulnerableLibrary/NLog.config new file mode 100644 index 0000000..6976f30 --- /dev/null +++ b/src/VulnerableLibrary/NLog.config @@ -0,0 +1,16 @@ + + + + + + + + + + + + \ No newline at end of file diff --git a/src/VulnerableLibrary/VulnerableLibrary.csproj b/src/VulnerableLibrary/VulnerableLibrary.csproj new file mode 100644 index 0000000..011e282 --- /dev/null +++ b/src/VulnerableLibrary/VulnerableLibrary.csproj @@ -0,0 +1,15 @@ + + + + net8.0 + enable + enable + + + + + + + + + diff --git a/src/VulnerableWebApi/Program.cs b/src/VulnerableWebApi/Program.cs new file mode 100644 index 0000000..4f658ff --- /dev/null +++ b/src/VulnerableWebApi/Program.cs @@ -0,0 +1,63 @@ +using Newtonsoft.Json; +using Microsoft.AspNetCore.Authentication.JwtBearer; + +var builder = WebApplication.CreateBuilder(args); + +// Add services to the container. +// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle +builder.Services.AddEndpointsApiExplorer(); +builder.Services.AddSwaggerGen(); + +// Example usage of vulnerable JWT Bearer authentication +builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) + .AddJwtBearer(); + +var app = builder.Build(); + +// Configure the HTTP request pipeline. +if (app.Environment.IsDevelopment()) +{ + app.UseSwagger(); + app.UseSwaggerUI(); +} + +app.UseHttpsRedirection(); +app.UseAuthentication(); + +var summaries = new[] +{ + "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching" +}; + +app.MapGet("/weatherforecast", () => +{ + var forecast = Enumerable.Range(1, 5).Select(index => + new WeatherForecast + ( + DateOnly.FromDateTime(DateTime.Now.AddDays(index)), + Random.Shared.Next(-20, 55), + summaries[Random.Shared.Next(summaries.Length)] + )) + .ToArray(); + return forecast; +}) +.WithName("GetWeatherForecast") +.WithOpenApi(); + +// Example endpoint using vulnerable Newtonsoft.Json +app.MapPost("/vulnerable-json", (object data) => +{ + // This demonstrates usage of vulnerable Newtonsoft.Json 10.0.1 + var json = JsonConvert.SerializeObject(data); + var deserialized = JsonConvert.DeserializeObject(json); + return Results.Ok(new { original = data, serialized = json, deserialized }); +}) +.WithName("VulnerableJsonHandling") +.WithOpenApi(); + +app.Run(); + +record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary) +{ + public int TemperatureF => 32 + (int)(TemperatureC / 0.5556); +} diff --git a/src/VulnerableWebApi/Properties/launchSettings.json b/src/VulnerableWebApi/Properties/launchSettings.json new file mode 100644 index 0000000..187dd3e --- /dev/null +++ b/src/VulnerableWebApi/Properties/launchSettings.json @@ -0,0 +1,41 @@ +{ + "$schema": "http://json.schemastore.org/launchsettings.json", + "iisSettings": { + "windowsAuthentication": false, + "anonymousAuthentication": true, + "iisExpress": { + "applicationUrl": "http://localhost:53501", + "sslPort": 44337 + } + }, + "profiles": { + "http": { + "commandName": "Project", + "dotnetRunMessages": true, + "launchBrowser": true, + "launchUrl": "swagger", + "applicationUrl": "http://localhost:5140", + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + } + }, + "https": { + "commandName": "Project", + "dotnetRunMessages": true, + "launchBrowser": true, + "launchUrl": "swagger", + "applicationUrl": "https://localhost:7276;http://localhost:5140", + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + } + }, + "IIS Express": { + "commandName": "IISExpress", + "launchBrowser": true, + "launchUrl": "swagger", + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + } + } + } +} diff --git a/src/VulnerableWebApi/VulnerableWebApi.csproj b/src/VulnerableWebApi/VulnerableWebApi.csproj new file mode 100644 index 0000000..7bb6087 --- /dev/null +++ b/src/VulnerableWebApi/VulnerableWebApi.csproj @@ -0,0 +1,21 @@ + + + + net8.0 + enable + enable + + + + + + + + + + + + + + + diff --git a/src/VulnerableWebApi/VulnerableWebApi.http b/src/VulnerableWebApi/VulnerableWebApi.http new file mode 100644 index 0000000..3c35eb6 --- /dev/null +++ b/src/VulnerableWebApi/VulnerableWebApi.http @@ -0,0 +1,6 @@ +@VulnerableWebApi_HostAddress = http://localhost:5140 + +GET {{VulnerableWebApi_HostAddress}}/weatherforecast/ +Accept: application/json + +### diff --git a/src/VulnerableWebApi/appsettings.Development.json b/src/VulnerableWebApi/appsettings.Development.json new file mode 100644 index 0000000..0c208ae --- /dev/null +++ b/src/VulnerableWebApi/appsettings.Development.json @@ -0,0 +1,8 @@ +{ + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning" + } + } +} diff --git a/src/VulnerableWebApi/appsettings.json b/src/VulnerableWebApi/appsettings.json new file mode 100644 index 0000000..10f68b8 --- /dev/null +++ b/src/VulnerableWebApi/appsettings.json @@ -0,0 +1,9 @@ +{ + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning" + } + }, + "AllowedHosts": "*" +}